@j0hanz/filesystem-mcp 2.7.6 → 2.8.0

package/dist/core/fs.js.map

@@ -1 +1 @@
-{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../src/core/fs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EACL,KAAK,IAAI,OAAO,EAChB,EAAE,IAAI,IAAI,EACV,KAAK,IAAI,OAAO,EAChB,KAAK,IAAI,OAAO,EAChB,IAAI,IAAI,MAAM,EACd,OAAO,IAAI,SAAS,EACpB,QAAQ,IAAI,UAAU,EACtB,QAAQ,IAAI,UAAU,EACtB,MAAM,IAAI,QAAQ,EAClB,EAAE,IAAI,IAAI,EACV,KAAK,IAAI,OAAO,EAChB,IAAI,IAAI,MAAM,EACd,MAAM,IAAI,QAAQ,EAClB,SAAS,IAAI,WAAW,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EACL,SAAS,EACT,yBAAyB,EACzB,OAAO,EACP,SAAS,EACT,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAGvE,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAK/C,iFAAiF;AAEjF;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,SAAoB,EAAE,QAAgB;IACnE,IAAI,SAAS,GAAG,MAAM,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;YACzF,SAAS,GAAG,MAAM,SAAS,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,GAAG,EAAE,CAAC;AAEnB,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACnD,SAAS,CAAC;YACR,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtE,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAM;YAC3B,UAAU,IAAI,SAAS,CAAC;YACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC3B,IAAI,IAAI,KAAK,OAAO;oBAAE,QAAQ,EAAE,CAAC;gBACjC,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QACD,yEAAyE;QACzE,qEAAqE;QACrE,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC/E,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IACnB,SAAS,CAAY;IAE9B,YAAY,SAAoB;QAC9B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,MAAkB,EAAE,aAAqB;QAClE,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,sDAAsD;QACtD,MAAM,OAAO,GACX,UAAU,CAAC,MAAM,CAAC;YAClB,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,SAAS;YACzE,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,OAAO,CACf,SAAS,CAAC,aAAa,EACvB,oFAAoF,EACpF,aAAa,CACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAI,QAAgB,EAAE,EAA0C;QAChF,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC5D,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CACR,QAAgB,EAChB,OAA8C;QAE9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,KAAK,CACT,QAAgB,EAChB,OAAkC;QAElC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,QAAgB,EAChB,OAA0C;QAE1C,8EAA8E;QAC9E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACtE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,OAAuC;QACnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAe;QAC3C,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAClE,wEAAwE;QACxE,IAAI,QAAQ,KAAK,QAAQ;YAAE,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/E,MAAM,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,SAAS,CACb,QAAgB,EAChB,OAAe,EACf,UAAgD,EAAE;QAElD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAElE,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,UAAU,MAAM,CAAC;QAElD,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,YAAgC,CAAC;QACrC,IAAI,CAAC;YACH,YAAY,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,2EAA2E;YAC3E,0EAA0E;YAC1E,sBAAsB;YACtB,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CACT,qDAAqD,SAAS,0CAA0C,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAC3I,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,qEAAqE;YACrE,wEAAwE;YACxE,yEAAyE;YACzE,wDAAwD;YACxD,MAAM,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE;gBACnC,MAAM;gBACN,IAAI,EAAE,IAAI;gBACV,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;YACH,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACxC,CAAC;YACD,wEAAwE;YACxE,mEAAmE;YACnE,yEAAyE;YACzE,sEAAsE;YACtE,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CACT,gCAAgC,QAAQ,uBAAuB,yBAAyB,CAAC,KAAK,CAAC,MAAM,yBAAyB,CAAC,YAAY,CAAC,EAAE,CAC/I,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CACd,QAAgB,EAChB,OAAe,EACf,UAAgD,EAAE;QAElD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAClE,sEAAsE;QACtE,wEAAwE;QACxE,oEAAoE;QACpE,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,eAAe,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzC,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QACD,oEAAoE;QACpE,oEAAoE;QACpE,qEAAqE;QACrE,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,oEAAoE;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,qBAAqB;QACrB,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,MAAkB,CAAC;QACvB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;gBACzD,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBAChE,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,8EAA8E;YAC9E,oDAAoD;YACpD,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAChE,+DAA+D;YAC/D,oEAAoE;YACpE,mEAAmE;YACnE,gEAAgE;YAChE,eAAe;YACf,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,WAAoB,EAAE,EAAE;oBACvD,MAAM,CAAC,IAAI,CACT,kCAAkC,SAAS,2BAA2B,yBAAyB,CAAC,WAAW,CAAC,EAAE,CAC/G,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAAgB,EAAE,IAAY;QACpD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACvC,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,EAAE,CAAC,QAAgB,EAAE,OAAoC;QAC7D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,OAAuC;QACnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,EAAE,CACN,MAAc,EACd,WAAmB,EACnB,OAAoC;QAEpC,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,IAAc;QAC7C,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,iBAAiB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CACpE,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC5C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,QAAgB,EAChB,OAAiD;QAEjD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;YACzB,6EAA6E;YAC7E,MAAM,IAAI,OAAO,CACf,SAAS,CAAC,SAAS,EACnB,sBAAsB,OAAO,EAAE,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,IAAI,YAAY,OAAO,SAAS,EACxF,QAAQ,EACR,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAC3C,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CACzC,QAAQ,EACR,SAAS,EACT,KAAK,EACL;YACE,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,IAAI;YAChB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,EACD,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACxD,CAAC;QACF,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CACX,QAAgB,EAChB,OAAkC;QAElC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjC,8EAA8E;QAC9E,6DAA6D;QAC7D,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,IAAI,GAAG,eAAe,EAAE,CAAC;YACjC,MAAM,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClD,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8DAA8D;YAC9D,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACpC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3D,OAAO;YACL,OAAO;YACP,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,IAAI,KAAK,MAAM;SACnC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,gEAAgE;IAChE,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,OAAkC;QAElC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,GAC9C,MAAM,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,OAAe;QACxC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC/B,OAAO,KAAK,KAAK,IAAI,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,QAAiB,EAAE,EAAE;gBAC5C,MAAM,CAAC,IAAI,CACT,kCAAkC,OAAO,KAAK,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CACpF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAmC,EACnC,IAAY,EACZ,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,wCAAwC,IAAI,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport type { Stats } from 'node:fs';\nimport type { FileHandle } from 'node:fs/promises';\nimport {\n  chmod as fsChmod,\n  cp as fsCp,\n  lstat as fsLstat,\n  mkdir as fsMkdir,\n  open as fsOpen,\n  opendir as fsOpendir,\n  readFile as fsReadFile,\n  readlink as fsReadlink,\n  rename as fsRename,\n  rm as fsRm,\n  rmdir as fsRmdir,\n  stat as fsStat,\n  unlink as fsUnlink,\n  writeFile as fsWriteFile,\n} from 'node:fs/promises';\nimport { dirname, isAbsolute, resolve } from 'node:path';\n\nimport { runExclusive, withAbort } from './concurrency.ts';\nimport {\n  ErrorCode,\n  formatUnknownErrorMessage,\n  FsError,\n  isFsError,\n  isNodeError,\n  isNotFoundErrno,\n} from './errors.ts';\nimport { detectMimeFromContent } from './mime.ts';\nimport { Logger } from './observability.ts';\nimport type { EntryType as FileType } from './path-utils.ts';\nimport { normalizePath, respellCaseOnlyTarget } from './path-utils.ts';\nimport type { PathGuard } from './path.ts';\nimport type { ReadFileResult, ReadSpec } from './read.ts';\nimport {\n  APPEND_CREATE_NOFOLLOW,\n  APPEND_NOFOLLOW,\n  assertFileStats,\n  createTooLargeError,\n  READ_NOFOLLOW,\n  readFileWithStats,\n} from './read.ts';\nimport { getMaxTextFileSize } from './util.ts';\n\nexport type { FileType };\nexport type { Stats };\n\n// ─── Domain primitives ────────────────────────────────────────────────────────\n\n/**\n * validatePathForWrite + symlink resolution: a write aimed at a link must land\n * on its revalidated target, not create a new file beside the link. ENOENT is\n * the normal new-file case, so it falls through with the original path.\n */\nasync function resolveForWrite(pathGuard: PathGuard, filePath: string): Promise<string> {\n  let validPath = await pathGuard.validatePathForWrite(filePath);\n\n  try {\n    const stats = await fsLstat(validPath);\n    if (stats.isSymbolicLink()) {\n      const target = await fsReadlink(validPath);\n      const resolvedTarget = isAbsolute(target) ? target : resolve(dirname(validPath), target);\n      validPath = await pathGuard.validatePathForWrite(resolvedTarget);\n    }\n  } catch (error) {\n    if (!isNotFoundErrno(error)) {\n      throw error;\n    }\n  }\n\n  return validPath;\n}\n\nconst CHAR_LF = 10;\n\nconst LINE_COUNT_CHUNK_BYTES = 64 * 1024;\n\n/**\n * Line count for a file on disk, counting newline bytes in fixed 64 KiB\n * chunks so an arbitrarily large file (one append's result metadata) costs\n * bounded memory. NOT FileHandle.readLines: it decodes each physical line\n * whole, so a multi-GB single-line log OOMs the server after the append has\n * already landed — a reported failure invites a retry that appends twice.\n * Matches read.ts's countLines semantics: a trailing newline does not open\n * a new line, an unterminated final line counts, an empty file is 0.\n */\nexport async function countFileLines(filePath: string): Promise<number> {\n  const handle = await fsOpen(filePath, READ_NOFOLLOW);\n  try {\n    let newlines = 0;\n    let lastByte = 0;\n    let totalBytes = 0;\n    const chunk = Buffer.alloc(LINE_COUNT_CHUNK_BYTES);\n    for (;;) {\n      const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);\n      if (bytesRead === 0) break;\n      totalBytes += bytesRead;\n      for (let i = 0; i < bytesRead; i++) {\n        const byte = chunk[i] ?? 0;\n        if (byte === CHAR_LF) newlines++;\n        lastByte = byte;\n      }\n    }\n    // totalBytes is the empty-file sentinel: a NUL (0x00) final byte is real\n    // content and must count as an unterminated final line, not \"empty\".\n    return totalBytes === 0 ? 0 : lastByte === CHAR_LF ? newlines : newlines + 1;\n  } finally {\n    await handle.close();\n  }\n}\n\nexport class GuardedFileSystem {\n  readonly pathGuard: PathGuard;\n\n  constructor(pathGuard: PathGuard) {\n    this.pathGuard = pathGuard;\n  }\n\n  /**\n   * O_NOFOLLOW only guards the final component; an ANCESTOR directory swapped\n   * for a symlink after validation still passes. Re-read the open descriptor's\n   * real path (Linux `/proc/self/fd`; skipped elsewhere) and require it to stay\n   * inside the roots. Run before any byte is read or written through `handle`.\n   */\n  async #assertFdWithinRoots(handle: FileHandle, requestedPath: string): Promise<void> {\n    let fdPath: string;\n    try {\n      fdPath = await fsReadlink(`/proc/self/fd/${String(handle.fd)}`);\n    } catch {\n      return;\n    }\n    // A replaced target reads back as \"<path> (deleted)\".\n    const inRoots =\n      isAbsolute(fdPath) &&\n      !fdPath.endsWith(' (deleted)') &&\n      this.pathGuard.allowedRootContaining(normalizePath(fdPath)) !== undefined &&\n      !this.pathGuard.isSensitive(normalizePath(fdPath));\n    if (!inRoots) {\n      throw new FsError(\n        ErrorCode.ACCESS_DENIED,\n        'Path changed under validation and now resolves outside the allowed roots (TOCTOU).',\n        requestedPath,\n      );\n    }\n  }\n\n  /**\n   * Serialize a read-modify-write on the resolved write target, so two writers\n   * of one file (any spelling, including via a symlinked parent) cannot both\n   * read the same base and have the last rename win. `writeFile`/`appendFile`\n   * do not take the lock, so `fn` may call them.\n   */\n  async lockForWrite<T>(filePath: string, fn: (resolvedTarget: string) => Promise<T>): Promise<T> {\n    const key = await resolveForWrite(this.pathGuard, filePath);\n    return runExclusive(key, () => fn(key));\n  }\n\n  async stat(\n    filePath: string,\n    options?: { signal?: AbortSignal | undefined },\n  ): Promise<{ stats: Stats; validPath: string }> {\n    const validPath = await this.pathGuard.validateExistingPath(filePath);\n    const stats = await withAbort(fsStat(validPath), options?.signal);\n    return { stats, validPath };\n  }\n\n  async lstat(\n    filePath: string,\n    options?: { signal?: AbortSignal },\n  ): Promise<{ stats: Stats; validPath: string }> {\n    const validPath = await this.pathGuard.validatePathForDelete(filePath);\n    const stats = await withAbort(fsLstat(validPath), options?.signal);\n    return { stats, validPath };\n  }\n\n  async readlink(\n    filePath: string,\n    options?: Parameters<typeof fsReadlink>[1],\n  ): Promise<{ linkString: string; validPath: string }> {\n    // validateExistingPath resolves through the symlink, so readlink would always\n    // be handed the final target — a regular file — and fail EINVAL. This guard\n    // keeps the link itself while still enforcing containment and the denylist.\n    const validPath = await this.pathGuard.validatePathForDelete(filePath);\n    const raw = await fsReadlink(validPath, options);\n    const linkString = Buffer.isBuffer(raw) ? raw.toString('utf-8') : raw;\n    return { linkString, validPath };\n  }\n\n  async mkdir(filePath: string, options?: Parameters<typeof fsMkdir>[1]): Promise<void> {\n    const validPath = await this.pathGuard.validatePathForWrite(filePath);\n    await fsMkdir(validPath, options);\n  }\n\n  async rename(oldPath: string, newPath: string): Promise<void> {\n    // Not validateExistingPath: that resolves through a symlink, so renaming a\n    // link would rename its target and leave the link dangling.\n    const validOld = await this.pathGuard.validatePathForDelete(oldPath);\n    let validNew = await this.pathGuard.validatePathForWrite(newPath);\n    // Renaming a path onto itself is only meaningful as a case-only rename.\n    if (validOld === validNew) validNew = respellCaseOnlyTarget(newPath, validNew);\n    await fsRename(validOld, validNew);\n  }\n\n  async writeFile(\n    filePath: string,\n    content: string,\n    options: { signal?: AbortSignal | undefined } = {},\n  ): Promise<{ validPath: string }> {\n    const { signal } = options;\n    const validPath = await resolveForWrite(this.pathGuard, filePath);\n\n    const tempSuffix = randomUUID().replace(/-/g, '').slice(0, 12);\n    const tempPath = `${validPath}.${tempSuffix}.tmp`;\n\n    // The rename below swaps in the temp file's inode, so the target would\n    // inherit fsWriteFile's default 0o666 & ~umask — silently widening a 0600\n    // file to 0644 on every write. Carry the existing mode across instead.\n    let existingMode: number | undefined;\n    try {\n      existingMode = (await fsStat(validPath)).mode & 0o777;\n    } catch (error) {\n      // ENOENT is the normal new-file case: the default mode is correct there.\n      // Anything else (EACCES, EIO) means the mode about to be overwritten could\n      // not be read, and the write will silently widen the file — say so rather\n      // than swallowing it.\n      if (!isNotFoundErrno(error)) {\n        Logger.warn(\n          `atomicWriteFile: cannot read the existing mode of ${validPath}; the write will use the default mode: ${formatUnknownErrorMessage(error)}`,\n        );\n      }\n    }\n\n    try {\n      signal?.throwIfAborted();\n      // Create the temp file already narrowed to the target's mode: a 0600\n      // file's new bytes must never sit at 0644 while the write is in flight.\n      // `wx` fails on a name collision instead of overwriting; the chmod below\n      // still restores bits the umask masked off at creation.\n      await fsWriteFile(tempPath, content, {\n        signal,\n        flag: 'wx',\n        ...(existingMode !== undefined ? { mode: existingMode } : {}),\n      });\n      if (existingMode !== undefined) {\n        await fsChmod(tempPath, existingMode);\n      }\n      // Last cancellation point. The rename IS the commit: once it starts the\n      // target may already be replaced, so it is never raced against the\n      // signal — a withAbort race would report a finished write as failed, and\n      // a client retry would apply it twice (same reasoning as appendFile).\n      signal?.throwIfAborted();\n      await fsRename(tempPath, validPath);\n    } catch (error) {\n      try {\n        await fsUnlink(tempPath);\n      } catch (cleanupError) {\n        Logger.warn(\n          `Failed to clean up temp file ${tempPath} after write error (${formatUnknownErrorMessage(error)}): ${formatUnknownErrorMessage(cleanupError)}`,\n        );\n      }\n      throw error;\n    }\n    return { validPath };\n  }\n\n  /**\n   * Append to the existing file (created if missing). Deliberately NOT the\n   * writeFile temp+rename dance: the rename would swap in a fresh inode,\n   * and the whole point of appending is to extend the file that's already\n   * there — inode and mode survive by construction.\n   */\n  async appendFile(\n    filePath: string,\n    content: string,\n    options: { signal?: AbortSignal | undefined } = {},\n  ): Promise<{ validPath: string }> {\n    const { signal } = options;\n    const validPath = await resolveForWrite(this.pathGuard, filePath);\n    // Non-regular targets must be rejected before the open: 'a' on a FIFO\n    // (POSIX) blocks until a reader appears, and fsOpen takes no signal, so\n    // the call would hang unabortable and pin its concurrency slot. The\n    // overwrite path can't hang — it writes a temp file and renames over.\n    // resolveForWrite has already resolved any symlink to its target, so the\n    // lstat here doubles as the new-vs-existing probe for the cleanup below.\n    let existed = true;\n    try {\n      assertFileStats(validPath, await fsLstat(validPath));\n    } catch (error) {\n      if (!isNotFoundErrno(error)) throw error;\n      existed = false;\n    }\n    // fs.promises.appendFile takes no signal, so a withAbort race would\n    // report failure while the append still lands — a client retry then\n    // appends twice. A handle opened with 'a' gets a genuinely abortable\n    // FileHandle.writeFile instead, same as the writeFile path. 'a' on a\n    // missing target CREATES it, so: check the signal before the open, and\n    // if the call then fails after creating the file, remove what it made —\n    // an aborted or errored call must not leave a phantom file behind.\n    // The pre-open lstat only proves the file was missing a moment ago:\n    // 'ax' makes creation exclusive, so a racer that created it in between\n    // fails EEXIST, reopens plainly, and never claims cleanup rights over\n    // the winner's file.\n    signal?.throwIfAborted();\n    let created = false;\n    let handle: FileHandle;\n    if (existed) {\n      handle = await fsOpen(validPath, APPEND_NOFOLLOW);\n    } else {\n      try {\n        handle = await fsOpen(validPath, APPEND_CREATE_NOFOLLOW);\n        created = true;\n      } catch (error) {\n        if (!isNodeError(error) || error.code !== 'EEXIST') throw error;\n        handle = await fsOpen(validPath, APPEND_NOFOLLOW);\n      }\n    }\n    try {\n      signal?.throwIfAborted();\n      // A file we just O_EXCL-created is a fresh regular file; only an existing one\n      // can have been reached through a swapped ancestor.\n      if (!created) await this.#assertFdWithinRoots(handle, filePath);\n      // Ceiling: an append is not transactional, so an abort landing\n      // mid-write can leave a prefix of the content on disk. Unwiring the\n      // signal would trade that for a silently-completed write; a client\n      // that retries is double-appending either way, so the abortable\n      // write stays.\n      await handle.writeFile(content, { signal });\n    } catch (error) {\n      if (created) {\n        await fsUnlink(validPath).catch((unlinkError: unknown) => {\n          Logger.warn(\n            `Failed to remove newly created ${validPath} after a failed append: ${formatUnknownErrorMessage(unlinkError)}`,\n          );\n        });\n      }\n      throw error;\n    } finally {\n      await handle.close();\n    }\n    return { validPath };\n  }\n\n  /**\n   * Leading bytes of a file, for MIME sniffing without loading the whole\n   * file — an append's result must describe the resulting file (which may be\n   * a multi-GB log), not the chunk that was appended.\n   */\n  async readLeadingSample(filePath: string, size: number): Promise<Buffer> {\n    const { validPath } = await this.stat(filePath);\n    const handle = await fsOpen(validPath, READ_NOFOLLOW);\n    try {\n      const buffer = Buffer.alloc(size);\n      const { bytesRead } = await handle.read(buffer, 0, size, 0);\n      return buffer.subarray(0, bytesRead);\n    } finally {\n      await handle.close();\n    }\n  }\n\n  async rm(filePath: string, options?: Parameters<typeof fsRm>[1]): Promise<void> {\n    const validPath = await this.pathGuard.validatePathForDelete(filePath);\n    await fsRm(validPath, options);\n  }\n\n  async rmdir(filePath: string, options?: Parameters<typeof fsRmdir>[1]): Promise<void> {\n    const validPath = await this.pathGuard.validatePathForDelete(filePath);\n    await fsRmdir(validPath, options);\n  }\n\n  async cp(\n    source: string,\n    destination: string,\n    options?: Parameters<typeof fsCp>[2],\n  ): Promise<void> {\n    // As in rename: keep the link itself so callers passing verbatimSymlinks\n    // actually copy the link rather than a dereferenced target.\n    const validSource = await this.pathGuard.validatePathForDelete(source);\n    const validDest = await this.pathGuard.validatePathForWrite(destination);\n    await fsCp(validSource, validDest, options);\n  }\n\n  async readFile(filePath: string, spec: ReadSpec): Promise<ReadFileResult> {\n    spec.signal?.throwIfAborted();\n    const validPath = await this.pathGuard.validateExistingPath(filePath);\n    const stats = await withAbort(fsStat(validPath), spec.signal);\n    return readFileWithStats(filePath, validPath, stats, spec, (handle) =>\n      this.#assertFdWithinRoots(handle, filePath),\n    );\n  }\n\n  async readEditableText(\n    filePath: string,\n    options?: { signal?: AbortSignal; tool?: string },\n  ): Promise<{ validPath: string; content: string; stats: Stats }> {\n    const { stats, validPath } = await this.stat(filePath, options);\n    const maxSize = getMaxTextFileSize();\n    if (stats.size > maxSize) {\n      // `tool` labels the TOO_LARGE message so the client sees which tool refused.\n      throw new FsError(\n        ErrorCode.TOO_LARGE,\n        `File too large for ${options?.tool ?? 'edit'} (${stats.size} bytes > ${maxSize} bytes)`,\n        filePath,\n        { size: stats.size, maxFileSize: maxSize },\n      );\n    }\n    const { content } = await readFileWithStats(\n      filePath,\n      validPath,\n      stats,\n      {\n        kind: 'full',\n        strictUtf8: true,\n        ...(options?.signal ? { signal: options.signal } : {}),\n      },\n      (handle) => this.#assertFdWithinRoots(handle, filePath),\n    );\n    return { validPath, content, stats };\n  }\n\n  async readRaw(\n    filePath: string,\n    options?: { signal?: AbortSignal },\n  ): Promise<{ content: Buffer; mimeType: string; isBinary: boolean }> {\n    options?.signal?.throwIfAborted();\n    const validPath = await this.pathGuard.validateExistingPath(filePath);\n    options?.signal?.throwIfAborted();\n    const stats = await withAbort(fsStat(validPath), options?.signal);\n    assertFileStats(filePath, stats);\n    // Enforce size limit before reading to avoid loading large files into memory.\n    // Binary detection is best-effort, but this is a hard limit.\n    const maxTextFileSize = getMaxTextFileSize();\n    if (stats.size > maxTextFileSize) {\n      throw createTooLargeError(stats.size, maxTextFileSize, filePath);\n    }\n    let content: Buffer;\n    const handle = await fsOpen(validPath, READ_NOFOLLOW);\n    try {\n      await this.#assertFdWithinRoots(handle, filePath);\n      content = await fsReadFile(handle, options);\n    } catch (error) {\n      // Node wraps even a TimeoutError signal reason in AbortError.\n      if (error instanceof Error && error.name === 'AbortError') {\n        options?.signal?.throwIfAborted();\n      }\n      throw error;\n    } finally {\n      await handle.close();\n    }\n    const mimeInfo = detectMimeFromContent(validPath, content);\n    return {\n      content,\n      mimeType: mimeInfo.mimeType,\n      isBinary: mimeInfo.kind !== 'text',\n    };\n  }\n\n  async open(filePath: string): Promise<FileHandle> {\n    const validPath = await this.pathGuard.validateExistingPath(filePath);\n    const handle = await fsOpen(validPath, READ_NOFOLLOW);\n    try {\n      await this.#assertFdWithinRoots(handle, filePath);\n    } catch (error) {\n      await handle.close();\n      throw error;\n    }\n    return handle;\n  }\n\n  // Single resolution + stat: validateExistingPathDetailed resolves the real\n  // path (following symlinks, re-checking sensitivity) once, then we stat the\n  // resolved target. Replaces the tool-side validateExistingPathDetailed +\n  // fs.stat pair that re-validated through the free stat() guard.\n  async statDetailed(\n    filePath: string,\n    options?: { signal?: AbortSignal },\n  ): Promise<{ requestedPath: string; isSymlink: boolean; stats: Stats }> {\n    const { requestedPath, resolvedPath, isSymlink } =\n      await this.pathGuard.validateExistingPathDetailed(filePath);\n    const stats = await withAbort(fsStat(resolvedPath), options?.signal);\n    return { requestedPath, isSymlink, stats };\n  }\n\n  async hasChildrenUnchecked(dirPath: string): Promise<boolean> {\n    const dir = await fsOpendir(dirPath);\n    try {\n      const entry = await dir.read();\n      return entry !== null;\n    } finally {\n      await dir.close().catch((closeErr: unknown) => {\n        Logger.warn(\n          `Failed to close dir handle for ${dirPath}: ${formatUnknownErrorMessage(closeErr)}`,\n        );\n      });\n    }\n  }\n}\n\n/**\n * Returns whether `path` exists, treating \"not found\" as absent and logging any\n * other stat failure. Used for TOCTOU re-checks between plan and execute phases.\n */\nexport async function destExists(\n  fs: Pick<GuardedFileSystem, 'stat'>,\n  path: string,\n  label: string,\n): Promise<boolean> {\n  try {\n    await fs.stat(path);\n    return true;\n  } catch (err) {\n    const missing = isNotFoundErrno(err) || (isFsError(err) && err.code === ErrorCode.NOT_FOUND);\n    if (!missing) {\n      Logger.warn(`${label}: dest stat failed unexpectedly for \"${path}\": ${String(err)}`);\n    }\n    return false;\n  }\n}\n"]}
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../src/core/fs.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EACL,KAAK,IAAI,OAAO,EAChB,EAAE,IAAI,IAAI,EACV,KAAK,IAAI,OAAO,EAChB,KAAK,IAAI,OAAO,EAChB,IAAI,IAAI,MAAM,EACd,OAAO,IAAI,SAAS,EACpB,QAAQ,IAAI,UAAU,EACtB,QAAQ,IAAI,UAAU,EACtB,MAAM,IAAI,QAAQ,EAClB,EAAE,IAAI,IAAI,EACV,KAAK,IAAI,OAAO,EAChB,IAAI,IAAI,MAAM,EACd,MAAM,IAAI,QAAQ,EAClB,SAAS,IAAI,WAAW,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EACL,SAAS,EACT,yBAAyB,EACzB,OAAO,EACP,SAAS,EACT,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAGvE,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAK/C,iFAAiF;AAEjF;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,SAAoB,EAAE,QAAgB;IACnE,IAAI,SAAS,GAAG,MAAM,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;YACzF,SAAS,GAAG,MAAM,SAAS,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,GAAG,EAAE,CAAC;AAEnB,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,MAAM,OAAO,iBAAiB;IACnB,SAAS,CAAY;IAE9B,YAAY,SAAoB;QAC9B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,MAAkB,EAAE,aAAqB;QAClE,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,sDAAsD;QACtD,MAAM,OAAO,GACX,UAAU,CAAC,MAAM,CAAC;YAClB,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,SAAS;YACzE,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,OAAO,CACf,SAAS,CAAC,aAAa,EACvB,oFAAoF,EACpF,aAAa,CACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAI,QAAgB,EAAE,EAA0C;QAChF,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC5D,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CACR,QAAgB,EAChB,OAA8C;QAE9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,KAAK,CACT,QAAgB,EAChB,OAAkC;QAElC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,QAAgB,EAChB,OAA0C;QAE1C,8EAA8E;QAC9E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACtE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,OAAuC;QACnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAe;QAC3C,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAClE,wEAAwE;QACxE,IAAI,QAAQ,KAAK,QAAQ;YAAE,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/E,MAAM,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,SAAS,CACb,QAAgB,EAChB,OAAe,EACf,UAAgD,EAAE;QAElD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAElE,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,UAAU,MAAM,CAAC;QAElD,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,YAAgC,CAAC;QACrC,IAAI,CAAC;YACH,YAAY,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,2EAA2E;YAC3E,0EAA0E;YAC1E,sBAAsB;YACtB,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CACT,qDAAqD,SAAS,0CAA0C,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAC3I,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,qEAAqE;YACrE,wEAAwE;YACxE,yEAAyE;YACzE,wDAAwD;YACxD,MAAM,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE;gBACnC,MAAM;gBACN,IAAI,EAAE,IAAI;gBACV,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;YACH,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACxC,CAAC;YACD,wEAAwE;YACxE,mEAAmE;YACnE,yEAAyE;YACzE,sEAAsE;YACtE,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CACT,gCAAgC,QAAQ,uBAAuB,yBAAyB,CAAC,KAAK,CAAC,MAAM,yBAAyB,CAAC,YAAY,CAAC,EAAE,CAC/I,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CACd,QAAgB,EAChB,OAAe,EACf,UAAgD,EAAE;QAElD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAClE,sEAAsE;QACtE,wEAAwE;QACxE,oEAAoE;QACpE,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,eAAe,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzC,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QACD,oEAAoE;QACpE,oEAAoE;QACpE,qEAAqE;QACrE,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,oEAAoE;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,qBAAqB;QACrB,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,MAAkB,CAAC;QACvB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;gBACzD,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBAChE,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,8EAA8E;YAC9E,oDAAoD;YACpD,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAChE,+DAA+D;YAC/D,oEAAoE;YACpE,mEAAmE;YACnE,gEAAgE;YAChE,eAAe;YACf,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,WAAoB,EAAE,EAAE;oBACvD,MAAM,CAAC,IAAI,CACT,kCAAkC,SAAS,2BAA2B,yBAAyB,CAAC,WAAW,CAAC,EAAE,CAC/G,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAAgB;;;YACtC,MAAY,MAAM,kCAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAA,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC9C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;YACxE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;;;;;;;;;;;KACtC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAAC,QAAgB;;;YACnC,MAAY,MAAM,kCAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAA,CAAC;YAC/C,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACnD,SAAS,CAAC;gBACR,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACtE,IAAI,SAAS,KAAK,CAAC;oBAAE,MAAM;gBAC3B,UAAU,IAAI,SAAS,CAAC;gBACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;oBACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBAC3B,IAAI,IAAI,KAAK,OAAO;wBAAE,QAAQ,EAAE,CAAC;oBACjC,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,yEAAyE;YACzE,qEAAqE;YACrE,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;;;;;;;;;;;KAC9E;IAED,KAAK,CAAC,EAAE,CAAC,QAAgB,EAAE,OAAoC;QAC7D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,OAAuC;QACnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,EAAE,CACN,MAAc,EACd,WAAmB,EACnB,OAAoC;QAEpC,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,IAAc;QAC7C,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,iBAAiB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CACpE,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC5C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,QAAgB,EAChB,OAAiD;QAEjD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;YACzB,6EAA6E;YAC7E,MAAM,IAAI,OAAO,CACf,SAAS,CAAC,SAAS,EACnB,sBAAsB,OAAO,EAAE,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,IAAI,YAAY,OAAO,SAAS,EACxF,QAAQ,EACR,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAC3C,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CACzC,QAAQ,EACR,SAAS,EACT,KAAK,EACL;YACE,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,IAAI;YAChB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,EACD,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACxD,CAAC;QACF,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CACX,QAAgB,EAChB,OAAkC;QAElC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjC,8EAA8E;QAC9E,6DAA6D;QAC7D,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,IAAI,GAAG,eAAe,EAAE,CAAC;YACjC,MAAM,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClD,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8DAA8D;YAC9D,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACpC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3D,OAAO;YACL,OAAO;YACP,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,IAAI,KAAK,MAAM;SACnC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,gEAAgE;IAChE,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,OAAkC;QAElC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,GAC9C,MAAM,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,OAAe;QACxC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC/B,OAAO,KAAK,KAAK,IAAI,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,QAAiB,EAAE,EAAE;gBAC5C,MAAM,CAAC,IAAI,CACT,kCAAkC,OAAO,KAAK,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CACpF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAmC,EACnC,IAAY,EACZ,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,wCAAwC,IAAI,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport type { Stats } from 'node:fs';\nimport type { FileHandle } from 'node:fs/promises';\nimport {\n  chmod as fsChmod,\n  cp as fsCp,\n  lstat as fsLstat,\n  mkdir as fsMkdir,\n  open as fsOpen,\n  opendir as fsOpendir,\n  readFile as fsReadFile,\n  readlink as fsReadlink,\n  rename as fsRename,\n  rm as fsRm,\n  rmdir as fsRmdir,\n  stat as fsStat,\n  unlink as fsUnlink,\n  writeFile as fsWriteFile,\n} from 'node:fs/promises';\nimport { dirname, isAbsolute, resolve } from 'node:path';\n\nimport { runExclusive, withAbort } from './concurrency.ts';\nimport {\n  ErrorCode,\n  formatUnknownErrorMessage,\n  FsError,\n  isFsError,\n  isNodeError,\n  isNotFoundErrno,\n} from './errors.ts';\nimport { detectMimeFromContent, MIME_SAMPLE_SIZE } from './mime.ts';\nimport { Logger } from './observability.ts';\nimport type { EntryType as FileType } from './path-utils.ts';\nimport { normalizePath, respellCaseOnlyTarget } from './path-utils.ts';\nimport type { PathGuard } from './path.ts';\nimport type { ReadFileResult, ReadSpec } from './read.ts';\nimport {\n  APPEND_CREATE_NOFOLLOW,\n  APPEND_NOFOLLOW,\n  assertFileStats,\n  createTooLargeError,\n  READ_NOFOLLOW,\n  readFileWithStats,\n} from './read.ts';\nimport { getMaxTextFileSize } from './util.ts';\n\nexport type { FileType };\nexport type { Stats };\n\n// ─── Domain primitives ────────────────────────────────────────────────────────\n\n/**\n * validatePathForWrite + symlink resolution: a write aimed at a link must land\n * on its revalidated target, not create a new file beside the link. ENOENT is\n * the normal new-file case, so it falls through with the original path.\n */\nasync function resolveForWrite(pathGuard: PathGuard, filePath: string): Promise<string> {\n  let validPath = await pathGuard.validatePathForWrite(filePath);\n\n  try {\n    const stats = await fsLstat(validPath);\n    if (stats.isSymbolicLink()) {\n      const target = await fsReadlink(validPath);\n      const resolvedTarget = isAbsolute(target) ? target : resolve(dirname(validPath), target);\n      validPath = await pathGuard.validatePathForWrite(resolvedTarget);\n    }\n  } catch (error) {\n    if (!isNotFoundErrno(error)) {\n      throw error;\n    }\n  }\n\n  return validPath;\n}\n\nconst CHAR_LF = 10;\n\nconst LINE_COUNT_CHUNK_BYTES = 64 * 1024;\n\nexport class GuardedFileSystem {\n  readonly pathGuard: PathGuard;\n\n  constructor(pathGuard: PathGuard) {\n    this.pathGuard = pathGuard;\n  }\n\n  /**\n   * O_NOFOLLOW only guards the final component; an ANCESTOR directory swapped\n   * for a symlink after validation still passes. Re-read the open descriptor's\n   * real path (Linux `/proc/self/fd`; skipped elsewhere) and require it to stay\n   * inside the roots. Run before any byte is read or written through `handle`.\n   */\n  async #assertFdWithinRoots(handle: FileHandle, requestedPath: string): Promise<void> {\n    let fdPath: string;\n    try {\n      fdPath = await fsReadlink(`/proc/self/fd/${String(handle.fd)}`);\n    } catch {\n      return;\n    }\n    // A replaced target reads back as \"<path> (deleted)\".\n    const inRoots =\n      isAbsolute(fdPath) &&\n      !fdPath.endsWith(' (deleted)') &&\n      this.pathGuard.allowedRootContaining(normalizePath(fdPath)) !== undefined &&\n      !this.pathGuard.isSensitive(normalizePath(fdPath));\n    if (!inRoots) {\n      throw new FsError(\n        ErrorCode.ACCESS_DENIED,\n        'Path changed under validation and now resolves outside the allowed roots (TOCTOU).',\n        requestedPath,\n      );\n    }\n  }\n\n  /**\n   * Serialize a read-modify-write on the resolved write target, so two writers\n   * of one file (any spelling, including via a symlinked parent) cannot both\n   * read the same base and have the last rename win. `writeFile`/`appendFile`\n   * do not take the lock, so `fn` may call them.\n   */\n  async lockForWrite<T>(filePath: string, fn: (resolvedTarget: string) => Promise<T>): Promise<T> {\n    const key = await resolveForWrite(this.pathGuard, filePath);\n    return runExclusive(key, () => fn(key));\n  }\n\n  async stat(\n    filePath: string,\n    options?: { signal?: AbortSignal | undefined },\n  ): Promise<{ stats: Stats; validPath: string }> {\n    const validPath = await this.pathGuard.validateExistingPath(filePath);\n    const stats = await withAbort(fsStat(validPath), options?.signal);\n    return { stats, validPath };\n  }\n\n  async lstat(\n    filePath: string,\n    options?: { signal?: AbortSignal },\n  ): Promise<{ stats: Stats; validPath: string }> {\n    const validPath = await this.pathGuard.validatePathForDelete(filePath);\n    const stats = await withAbort(fsLstat(validPath), options?.signal);\n    return { stats, validPath };\n  }\n\n  async readlink(\n    filePath: string,\n    options?: Parameters<typeof fsReadlink>[1],\n  ): Promise<{ linkString: string; validPath: string }> {\n    // validateExistingPath resolves through the symlink, so readlink would always\n    // be handed the final target — a regular file — and fail EINVAL. This guard\n    // keeps the link itself while still enforcing containment and the denylist.\n    const validPath = await this.pathGuard.validatePathForDelete(filePath);\n    const raw = await fsReadlink(validPath, options);\n    const linkString = Buffer.isBuffer(raw) ? raw.toString('utf-8') : raw;\n    return { linkString, validPath };\n  }\n\n  async mkdir(filePath: string, options?: Parameters<typeof fsMkdir>[1]): Promise<void> {\n    const validPath = await this.pathGuard.validatePathForWrite(filePath);\n    await fsMkdir(validPath, options);\n  }\n\n  async rename(oldPath: string, newPath: string): Promise<void> {\n    // Not validateExistingPath: that resolves through a symlink, so renaming a\n    // link would rename its target and leave the link dangling.\n    const validOld = await this.pathGuard.validatePathForDelete(oldPath);\n    let validNew = await this.pathGuard.validatePathForWrite(newPath);\n    // Renaming a path onto itself is only meaningful as a case-only rename.\n    if (validOld === validNew) validNew = respellCaseOnlyTarget(newPath, validNew);\n    await fsRename(validOld, validNew);\n  }\n\n  async writeFile(\n    filePath: string,\n    content: string,\n    options: { signal?: AbortSignal | undefined } = {},\n  ): Promise<{ validPath: string }> {\n    const { signal } = options;\n    const validPath = await resolveForWrite(this.pathGuard, filePath);\n\n    const tempSuffix = randomUUID().replace(/-/g, '').slice(0, 12);\n    const tempPath = `${validPath}.${tempSuffix}.tmp`;\n\n    // The rename below swaps in the temp file's inode, so the target would\n    // inherit fsWriteFile's default 0o666 & ~umask — silently widening a 0600\n    // file to 0644 on every write. Carry the existing mode across instead.\n    let existingMode: number | undefined;\n    try {\n      existingMode = (await fsStat(validPath)).mode & 0o777;\n    } catch (error) {\n      // ENOENT is the normal new-file case: the default mode is correct there.\n      // Anything else (EACCES, EIO) means the mode about to be overwritten could\n      // not be read, and the write will silently widen the file — say so rather\n      // than swallowing it.\n      if (!isNotFoundErrno(error)) {\n        Logger.warn(\n          `atomicWriteFile: cannot read the existing mode of ${validPath}; the write will use the default mode: ${formatUnknownErrorMessage(error)}`,\n        );\n      }\n    }\n\n    try {\n      signal?.throwIfAborted();\n      // Create the temp file already narrowed to the target's mode: a 0600\n      // file's new bytes must never sit at 0644 while the write is in flight.\n      // `wx` fails on a name collision instead of overwriting; the chmod below\n      // still restores bits the umask masked off at creation.\n      await fsWriteFile(tempPath, content, {\n        signal,\n        flag: 'wx',\n        ...(existingMode !== undefined ? { mode: existingMode } : {}),\n      });\n      if (existingMode !== undefined) {\n        await fsChmod(tempPath, existingMode);\n      }\n      // Last cancellation point. The rename IS the commit: once it starts the\n      // target may already be replaced, so it is never raced against the\n      // signal — a withAbort race would report a finished write as failed, and\n      // a client retry would apply it twice (same reasoning as appendFile).\n      signal?.throwIfAborted();\n      await fsRename(tempPath, validPath);\n    } catch (error) {\n      try {\n        await fsUnlink(tempPath);\n      } catch (cleanupError) {\n        Logger.warn(\n          `Failed to clean up temp file ${tempPath} after write error (${formatUnknownErrorMessage(error)}): ${formatUnknownErrorMessage(cleanupError)}`,\n        );\n      }\n      throw error;\n    }\n    return { validPath };\n  }\n\n  /**\n   * Append to the existing file (created if missing). Deliberately NOT the\n   * writeFile temp+rename dance: the rename would swap in a fresh inode,\n   * and the whole point of appending is to extend the file that's already\n   * there — inode and mode survive by construction.\n   */\n  async appendFile(\n    filePath: string,\n    content: string,\n    options: { signal?: AbortSignal | undefined } = {},\n  ): Promise<{ validPath: string }> {\n    const { signal } = options;\n    const validPath = await resolveForWrite(this.pathGuard, filePath);\n    // Non-regular targets must be rejected before the open: 'a' on a FIFO\n    // (POSIX) blocks until a reader appears, and fsOpen takes no signal, so\n    // the call would hang unabortable and pin its concurrency slot. The\n    // overwrite path can't hang — it writes a temp file and renames over.\n    // resolveForWrite has already resolved any symlink to its target, so the\n    // lstat here doubles as the new-vs-existing probe for the cleanup below.\n    let existed = true;\n    try {\n      assertFileStats(validPath, await fsLstat(validPath));\n    } catch (error) {\n      if (!isNotFoundErrno(error)) throw error;\n      existed = false;\n    }\n    // fs.promises.appendFile takes no signal, so a withAbort race would\n    // report failure while the append still lands — a client retry then\n    // appends twice. A handle opened with 'a' gets a genuinely abortable\n    // FileHandle.writeFile instead, same as the writeFile path. 'a' on a\n    // missing target CREATES it, so: check the signal before the open, and\n    // if the call then fails after creating the file, remove what it made —\n    // an aborted or errored call must not leave a phantom file behind.\n    // The pre-open lstat only proves the file was missing a moment ago:\n    // 'ax' makes creation exclusive, so a racer that created it in between\n    // fails EEXIST, reopens plainly, and never claims cleanup rights over\n    // the winner's file.\n    signal?.throwIfAborted();\n    let created = false;\n    let handle: FileHandle;\n    if (existed) {\n      handle = await fsOpen(validPath, APPEND_NOFOLLOW);\n    } else {\n      try {\n        handle = await fsOpen(validPath, APPEND_CREATE_NOFOLLOW);\n        created = true;\n      } catch (error) {\n        if (!isNodeError(error) || error.code !== 'EEXIST') throw error;\n        handle = await fsOpen(validPath, APPEND_NOFOLLOW);\n      }\n    }\n    try {\n      signal?.throwIfAborted();\n      // A file we just O_EXCL-created is a fresh regular file; only an existing one\n      // can have been reached through a swapped ancestor.\n      if (!created) await this.#assertFdWithinRoots(handle, filePath);\n      // Ceiling: an append is not transactional, so an abort landing\n      // mid-write can leave a prefix of the content on disk. Unwiring the\n      // signal would trade that for a silently-completed write; a client\n      // that retries is double-appending either way, so the abortable\n      // write stays.\n      await handle.writeFile(content, { signal });\n    } catch (error) {\n      if (created) {\n        await fsUnlink(validPath).catch((unlinkError: unknown) => {\n          Logger.warn(\n            `Failed to remove newly created ${validPath} after a failed append: ${formatUnknownErrorMessage(unlinkError)}`,\n          );\n        });\n      }\n      throw error;\n    } finally {\n      await handle.close();\n    }\n    return { validPath };\n  }\n\n  /**\n   * Leading bytes of a file, for MIME sniffing without loading the whole\n   * file — an append's result must describe the resulting file (which may be\n   * a multi-GB log), not the chunk that was appended.\n   */\n  async readLeadingSample(filePath: string): Promise<Buffer> {\n    await using handle = await this.open(filePath);\n    const buffer = Buffer.alloc(MIME_SAMPLE_SIZE);\n    const { bytesRead } = await handle.read(buffer, 0, MIME_SAMPLE_SIZE, 0);\n    return buffer.subarray(0, bytesRead);\n  }\n\n  /**\n   * Line count for a file on disk, counting newline bytes in fixed 64 KiB\n   * chunks so an arbitrarily large file (one append's result metadata) costs\n   * bounded memory. NOT FileHandle.readLines: it decodes each physical line\n   * whole, so a multi-GB single-line log OOMs the server after the append has\n   * already landed — a reported failure invites a retry that appends twice.\n   * Matches read.ts's countLines semantics: a trailing newline does not open\n   * a new line, an unterminated final line counts, an empty file is 0.\n   */\n  async countFileLines(filePath: string): Promise<number> {\n    await using handle = await this.open(filePath);\n    let newlines = 0;\n    let lastByte = 0;\n    let totalBytes = 0;\n    const chunk = Buffer.alloc(LINE_COUNT_CHUNK_BYTES);\n    for (;;) {\n      const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);\n      if (bytesRead === 0) break;\n      totalBytes += bytesRead;\n      for (let i = 0; i < bytesRead; i++) {\n        const byte = chunk[i] ?? 0;\n        if (byte === CHAR_LF) newlines++;\n        lastByte = byte;\n      }\n    }\n    // totalBytes is the empty-file sentinel: a NUL (0x00) final byte is real\n    // content and must count as an unterminated final line, not \"empty\".\n    return totalBytes === 0 ? 0 : lastByte === CHAR_LF ? newlines : newlines + 1;\n  }\n\n  async rm(filePath: string, options?: Parameters<typeof fsRm>[1]): Promise<void> {\n    const validPath = await this.pathGuard.validatePathForDelete(filePath);\n    await fsRm(validPath, options);\n  }\n\n  async rmdir(filePath: string, options?: Parameters<typeof fsRmdir>[1]): Promise<void> {\n    const validPath = await this.pathGuard.validatePathForDelete(filePath);\n    await fsRmdir(validPath, options);\n  }\n\n  async cp(\n    source: string,\n    destination: string,\n    options?: Parameters<typeof fsCp>[2],\n  ): Promise<void> {\n    // As in rename: keep the link itself so callers passing verbatimSymlinks\n    // actually copy the link rather than a dereferenced target.\n    const validSource = await this.pathGuard.validatePathForDelete(source);\n    const validDest = await this.pathGuard.validatePathForWrite(destination);\n    await fsCp(validSource, validDest, options);\n  }\n\n  async readFile(filePath: string, spec: ReadSpec): Promise<ReadFileResult> {\n    spec.signal?.throwIfAborted();\n    const validPath = await this.pathGuard.validateExistingPath(filePath);\n    const stats = await withAbort(fsStat(validPath), spec.signal);\n    return readFileWithStats(filePath, validPath, stats, spec, (handle) =>\n      this.#assertFdWithinRoots(handle, filePath),\n    );\n  }\n\n  async readEditableText(\n    filePath: string,\n    options?: { signal?: AbortSignal; tool?: string },\n  ): Promise<{ validPath: string; content: string; stats: Stats }> {\n    const { stats, validPath } = await this.stat(filePath, options);\n    const maxSize = getMaxTextFileSize();\n    if (stats.size > maxSize) {\n      // `tool` labels the TOO_LARGE message so the client sees which tool refused.\n      throw new FsError(\n        ErrorCode.TOO_LARGE,\n        `File too large for ${options?.tool ?? 'edit'} (${stats.size} bytes > ${maxSize} bytes)`,\n        filePath,\n        { size: stats.size, maxFileSize: maxSize },\n      );\n    }\n    const { content } = await readFileWithStats(\n      filePath,\n      validPath,\n      stats,\n      {\n        kind: 'full',\n        strictUtf8: true,\n        ...(options?.signal ? { signal: options.signal } : {}),\n      },\n      (handle) => this.#assertFdWithinRoots(handle, filePath),\n    );\n    return { validPath, content, stats };\n  }\n\n  async readRaw(\n    filePath: string,\n    options?: { signal?: AbortSignal },\n  ): Promise<{ content: Buffer; mimeType: string; isBinary: boolean }> {\n    options?.signal?.throwIfAborted();\n    const validPath = await this.pathGuard.validateExistingPath(filePath);\n    options?.signal?.throwIfAborted();\n    const stats = await withAbort(fsStat(validPath), options?.signal);\n    assertFileStats(filePath, stats);\n    // Enforce size limit before reading to avoid loading large files into memory.\n    // Binary detection is best-effort, but this is a hard limit.\n    const maxTextFileSize = getMaxTextFileSize();\n    if (stats.size > maxTextFileSize) {\n      throw createTooLargeError(stats.size, maxTextFileSize, filePath);\n    }\n    let content: Buffer;\n    const handle = await fsOpen(validPath, READ_NOFOLLOW);\n    try {\n      await this.#assertFdWithinRoots(handle, filePath);\n      content = await fsReadFile(handle, options);\n    } catch (error) {\n      // Node wraps even a TimeoutError signal reason in AbortError.\n      if (error instanceof Error && error.name === 'AbortError') {\n        options?.signal?.throwIfAborted();\n      }\n      throw error;\n    } finally {\n      await handle.close();\n    }\n    const mimeInfo = detectMimeFromContent(validPath, content);\n    return {\n      content,\n      mimeType: mimeInfo.mimeType,\n      isBinary: mimeInfo.kind !== 'text',\n    };\n  }\n\n  async open(filePath: string): Promise<FileHandle> {\n    const validPath = await this.pathGuard.validateExistingPath(filePath);\n    const handle = await fsOpen(validPath, READ_NOFOLLOW);\n    try {\n      await this.#assertFdWithinRoots(handle, filePath);\n    } catch (error) {\n      await handle.close();\n      throw error;\n    }\n    return handle;\n  }\n\n  // Single resolution + stat: validateExistingPathDetailed resolves the real\n  // path (following symlinks, re-checking sensitivity) once, then we stat the\n  // resolved target. Replaces the tool-side validateExistingPathDetailed +\n  // fs.stat pair that re-validated through the free stat() guard.\n  async statDetailed(\n    filePath: string,\n    options?: { signal?: AbortSignal },\n  ): Promise<{ requestedPath: string; isSymlink: boolean; stats: Stats }> {\n    const { requestedPath, resolvedPath, isSymlink } =\n      await this.pathGuard.validateExistingPathDetailed(filePath);\n    const stats = await withAbort(fsStat(resolvedPath), options?.signal);\n    return { requestedPath, isSymlink, stats };\n  }\n\n  async hasChildrenUnchecked(dirPath: string): Promise<boolean> {\n    const dir = await fsOpendir(dirPath);\n    try {\n      const entry = await dir.read();\n      return entry !== null;\n    } finally {\n      await dir.close().catch((closeErr: unknown) => {\n        Logger.warn(\n          `Failed to close dir handle for ${dirPath}: ${formatUnknownErrorMessage(closeErr)}`,\n        );\n      });\n    }\n  }\n}\n\n/**\n * Returns whether `path` exists, treating \"not found\" as absent and logging any\n * other stat failure. Used for TOCTOU re-checks between plan and execute phases.\n */\nexport async function destExists(\n  fs: Pick<GuardedFileSystem, 'stat'>,\n  path: string,\n  label: string,\n): Promise<boolean> {\n  try {\n    await fs.stat(path);\n    return true;\n  } catch (err) {\n    const missing = isNotFoundErrno(err) || (isFsError(err) && err.code === ErrorCode.NOT_FOUND);\n    if (!missing) {\n      Logger.warn(`${label}: dest stat failed unexpectedly for \"${path}\": ${String(err)}`);\n    }\n    return false;\n  }\n}\n"]}

package/dist/core/glob.d.ts

@@ -1,4 +1,12 @@
 import type { DirentLike } from './path-utils.ts';
+/**
+ * More brace alternatives than this is not a file filter. fs.glob's matcher
+ * dedupes its alternatives pairwise, synchronously: `{1..100000}` pins the
+ * event loop for most of a minute, where 1024 costs tens of milliseconds.
+ */
+export declare const MAX_BRACE_ALTERNATIVES = 1024;
+/** Bound synchronous glob compilation when checking candidate traversal segments. */
+export declare const MAX_DOTDOT_CHECK_CHARS = 4096;
 export declare function isSafeGlobSyntax(pattern: string): boolean;
 export interface GlobEntry {
     path: string;

package/dist/core/glob.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["../../src/core/glob.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAOlD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAkBzD;AA8MD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kFAAkF;IAClF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AA6ND,wBAAuB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,cAAc,CAAC,SAAS,CAAC,CAwBzF"}
+{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["../../src/core/glob.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAIlD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C,qFAAqF;AACrF,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAoH3C,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAwBzD;AAqND,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kFAAkF;IAClF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAwPD,wBAAuB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,cAAc,CAAC,SAAS,CAAC,CAyBzF"}

package/dist/core/glob.js

@@ -1,29 +1,155 @@
 import { glob as fsGlob, readFile as fsReadFile, lstat } from 'node:fs/promises';
-import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { basename, dirname, join, matchesGlob, relative, resolve, win32 } from 'node:path';
 import ignore from 'ignore';
 import { processInParallel } from "./concurrency.js";
 import { formatUnknownErrorMessage } from "./errors.js";
 import { Logger } from "./observability.js";
-import { isPathInsideDirectory, isWindowsDriveRelativePath, toPosixPath } from "./path-utils.js";
+import { IS_WINDOWS, isPathInsideDirectory, toPosixPath } from "./path-utils.js";
 import { MIB } from "./util.js";
-/** `..` bounded on both sides by a separator, a brace delimiter, or the pattern edge. */
-const TRAVERSAL_DOTDOT_RE = /(?:^|[/\\{,])\.\.(?=[/\\},]|$)/u;
+/**
+ * More brace alternatives than this is not a file filter. fs.glob's matcher
+ * dedupes its alternatives pairwise, synchronously: `{1..100000}` pins the
+ * event loop for most of a minute, where 1024 costs tens of milliseconds.
+ */
+export const MAX_BRACE_ALTERNATIVES = 1024;
+/** Bound synchronous glob compilation when checking candidate traversal segments. */
+export const MAX_DOTDOT_CHECK_CHARS = 4096;
+// The range bodies fs.glob's brace expansion recognises, as it writes them.
+const NUMERIC_RANGE_RE = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/u;
+const ALPHA_RANGE_RE = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/u;
+/** The values a range body (`x..y`, `x..y..step`) expands to, or `undefined` past the cap. */
+function rangeValues(body) {
+    const alpha = ALPHA_RANGE_RE.test(body);
+    const [from = '', to = '', step = '1'] = body.split('..');
+    const bound = (end) => (alpha ? end.charCodeAt(0) : Number.parseInt(end, 10));
+    const start = bound(from);
+    const stop = bound(to);
+    const stride = Math.max(Math.abs(Number.parseInt(step, 10)), 1);
+    // Past 2^53 a step no longer moves the number (2^53 + 1 === 2^53), and past
+    // Number.MAX_VALUE it reads as Infinity: either way the loop below would
+    // never end. Refuse them like any other long range.
+    if (!Number.isSafeInteger(start) || !Number.isSafeInteger(stop))
+        return undefined;
+    if (Math.floor(Math.abs(stop - start) / stride) >= MAX_BRACE_ALTERNATIVES)
+        return undefined;
+    const values = [];
+    const direction = stop < start ? -1 : 1;
+    for (let i = start; (stop - i) * direction >= 0; i += stride * direction) {
+        // The engine drops a `\` a letter range passes through (`{Z..a}`), and
+        // digits can never spell a root or a `..`, so their padding is moot.
+        const char = String.fromCharCode(i);
+        values.push(alpha ? (char === '\\' ? '' : char) : String(i));
+    }
+    return values;
+}
+/**
+ * The leftmost `{…}` that fs.glob would expand: a comma list or a range.
+ * The expansion is textual, as fs.glob's is: a brace inside `[…]` still
+ * counts (unlike SensitiveMatcher's own glob dialect in sensitive.ts).
+ */
+function firstBraceSet(pattern) {
+    const open = [];
+    let first;
+    for (let i = 0; i < pattern.length; i++) {
+        const char = pattern[i];
+        if (char === '{')
+            open.push({ at: i, commas: [] });
+        else if (char === ',')
+            open.at(-1)?.commas.push(i);
+        else if (char === '}') {
+            const set = open.pop();
+            if (!set || (first && first.at < set.at))
+                continue;
+            const body = pattern.slice(set.at + 1, i);
+            if (set.commas.length > 0 || NUMERIC_RANGE_RE.test(body) || ALPHA_RANGE_RE.test(body)) {
+                first = { ...set, close: i };
+            }
+        }
+    }
+    if (!first)
+        return undefined;
+    let alternatives;
+    if (first.commas.length > 0) {
+        alternatives = [];
+        let start = first.at + 1;
+        for (const end of [...first.commas, first.close]) {
+            alternatives.push(pattern.slice(start, end));
+            start = end + 1;
+        }
+    }
+    else {
+        alternatives = rangeValues(pattern.slice(first.at + 1, first.close));
+    }
+    return { pre: pattern.slice(0, first.at), alternatives, post: pattern.slice(first.close + 1) };
+}
+/** Every brace alternative of `pattern`, or `undefined` past the cap. */
+function expandBraceSets(pattern, out = []) {
+    const set = firstBraceSet(pattern);
+    if (!set) {
+        out.push(pattern);
+        return out.length > MAX_BRACE_ALTERNATIVES ? undefined : out;
+    }
+    if (!set.alternatives)
+        return undefined;
+    for (const alternative of set.alternatives) {
+        if (!expandBraceSets(`${set.pre}${alternative}${set.post}`, out))
+            return undefined;
+    }
+    return out;
+}
+/** The characters minimatch can spell a literal `..` with: dots and one-character classes. */
+const DOTDOT_SPELLING_RE = /^[.[\]-]+$/u;
+/**
+ * Whether the glob engine reads this brace-free segment as `..`. readdir never
+ * yields `..`, so only a literal reaches it, and minimatch spells a literal dot
+ * as `.`, `[.]` or `[.-.]`. Any other character (`*`, `?`, an extglob, a
+ * letter) either makes the segment a pattern the walk never follows to `..`,
+ * or puts that character in the name. Only the rest is worth asking the engine
+ * about, so a long or exotic segment costs no compile; one the engine cannot
+ * compile is refused.
+ */
+const isTraversalSegment = (segment) => {
+    try {
+        return matchesGlob('..', segment);
+    }
+    catch {
+        return true;
+    }
+};
+/**
+ * An alternative that starts at a root: `/x`, `//host/share`, `C:/x`, `C:x`,
+ * on any host. On Windows fs.glob also reads a literal first segment ending in
+ * `:` as a drive (`[C]:/x`); elsewhere that is an ordinary name (`logs:`).
+ */
+const isRooted = (alternative) => win32.parse(alternative).root !== '' ||
+    (IS_WINDOWS && (alternative.split('/')[0] ?? '').endsWith(':'));
 export function isSafeGlobSyntax(pattern) {
     if (!pattern || pattern.trim().length === 0) {
         return false;
     }
-    if (isAbsolute(pattern)) {
-        return false;
-    }
-    if (isWindowsDriveRelativePath(pattern)) {
+    // The walk sees the pattern with `\` as `/` (normalizePattern), so check
+    // that form: `\etc\x` is `/etc/x` there, an absolute walk on any host.
+    // Brace sets can build a root or a `..` from parts (`{/etc,x}`, `..{,x}`,
+    // `.{Z..a}.`), so check every alternative, not the pattern as written.
+    // globEntries still drops any match outside its cwd: this check is what
+    // turns such a pattern into an error rather than a quietly narrower walk.
+    const alternatives = expandBraceSets(toPosixPath(pattern));
+    if (!alternatives)
         return false;
+    const segments = new Set();
+    for (const alternative of alternatives) {
+        if (isRooted(alternative))
+            return false;
+        for (const segment of alternative.split('/'))
+            segments.add(segment);
     }
-    // Only a whole `..` — a path segment, or one alternative of a `{a,..}`
-    // brace set — can traverse. `..` inside a segment (`[...slug]`, `v1..2.md`,
-    // `[..]`) is a literal name or a character class, and PathGuard re-checks
-    // containment on every resolved entry regardless.
-    if (TRAVERSAL_DOTDOT_RE.test(pattern)) {
-        return false;
+    let dotdotCheckChars = 0;
+    for (const segment of segments) {
+        if (!segment.includes('.') || !DOTDOT_SPELLING_RE.test(segment))
+            continue;
+        dotdotCheckChars += segment.length;
+        if (dotdotCheckChars > MAX_DOTDOT_CHECK_CHARS || isTraversalSegment(segment))
+            return false;
     }
     return true;
 }
@@ -101,11 +227,17 @@ class GitignoreManager {
         this.ancestors.push({ prefix, matcher });
     }
     /** `null` when no `.gitignore` was found, so callers skip the filter entirely. */
-    static async load(root, signal, maxDepth, ignoreCeiling) {
+    static async load(root, includeHidden, signal, maxDepth, ignoreCeiling) {
         const manager = new GitignoreManager();
         try {
             const gitignorePaths = [];
-            const gitignoreEntries = fsGlob('**/.gitignore', {
+            // Search dot-directories (.venv, .terraform, ...) for rules only when the
+            // walk includes hidden entries; for any other walk, enumerating every
+            // hidden tree would cost more than the walk itself.
+            const gitignorePatterns = includeHidden
+                ? [...buildHiddenPatterns('**/.gitignore')]
+                : ['**/.gitignore'];
+            const gitignoreEntries = fsGlob(gitignorePatterns, {
                 cwd: root,
                 // Skip what the walk itself skips, and stop one level past its depth
                 // bound: a .gitignore at depth d only affects entries at depth >= d.
@@ -207,7 +339,6 @@ class GitignoreManager {
 const GLOB_MAGIC_RE = /[*?[\]{}!]/u;
 const GLOB_BATCH_CONCURRENCY = 64;
 const SEP = '/';
-const DOT_CHAR_CODE = 46;
 function normalizePattern(pattern, baseNameMatch) {
     const normalized = toPosixPath(pattern);
     if (!baseNameMatch)
@@ -230,6 +361,26 @@ function splitPatternPrefix(normalizedPattern) {
         remainder: segments.slice(splitIndex).join(SEP),
     };
 }
+/**
+ * The segment matching the dot-prefixed names `segment` would match if fs.glob
+ * did not skip them, or `undefined` when there are none. Only a leading `*` or
+ * `?` stands for that dot: a literal never does, and a character class or a
+ * brace set is left as written rather than parsed.
+ */
+function dotVariant(segment) {
+    // `*(…)` and `?(…)` are extglobs, not wildcards.
+    if (segment[1] === '(')
+        return undefined;
+    if (segment.startsWith('*'))
+        return `.${segment}`;
+    if (!segment.startsWith('?'))
+        return undefined;
+    // `?` is exactly one character, so the dot replaces it, unless what follows
+    // could leave just `.` or `..` (`?`, `?.`, `?{.,x}`, `?[.]`): the directory
+    // and its parent, not a dot-prefixed entry.
+    const rest = segment.slice(1);
+    return rest === '' || /^[.[{]/u.test(rest) ? undefined : `.${rest}`;
+}
 function addFirstDotSegment(patterns, prefix, remainder) {
     if (remainder.length === 0)
         return;
@@ -237,9 +388,10 @@ function addFirstDotSegment(patterns, prefix, remainder) {
     const idx = segments.findIndex((seg) => seg !== '**' && seg.length > 0);
     if (idx !== -1) {
         const original = segments[idx];
-        if (original && original.charCodeAt(0) !== DOT_CHAR_CODE) {
+        const dotted = original ? dotVariant(original) : undefined;
+        if (dotted) {
             const newSegments = [...segments];
-            newSegments[idx] = `.${original}`;
+            newSegments[idx] = dotted;
             patterns.add(`${prefix}${newSegments.join(SEP)}`);
         }
     }
@@ -261,11 +413,12 @@ function expandHiddenGlobstars(patterns, prefix, remainder) {
     // starts with '.', and its `dot` option is not honored. So `**/*` alone misses
     // hidden files. Two depth-agnostic patterns cover everything the per-depth
     // unroll did: contents of dot-directories anywhere, and dotfiles/dotdirs
-    // anywhere.
+    // anywhere (when the first segment after the globstar can match a dot).
     patterns.add(`${prefix}**/.*/**/${afterGlobstar}`);
-    const addDotFile = afterGlobstar.length > 0 && afterGlobstar.charCodeAt(0) !== DOT_CHAR_CODE;
-    if (addDotFile)
-        patterns.add(`${prefix}**/.${afterGlobstar}`);
+    const [firstSegment = '', ...rest] = afterGlobstar.split(SEP);
+    const dotted = dotVariant(firstSegment);
+    if (dotted)
+        patterns.add(`${prefix}**/${[dotted, ...rest].join(SEP)}`);
 }
 function buildHiddenPatterns(normalizedPattern) {
     const patterns = new Set([normalizedPattern]);
@@ -292,6 +445,11 @@ function normalizeGlobOptions(options) {
 }
 function* processDirentMatch(match, cwd, maxDepth, seen, onlyFiles) {
     const absolutePath = resolve(cwd, match.parentPath, match.name);
+    // The walk's scope is its cwd, whatever the pattern spells: a `..` or a root
+    // the validator did not foresee must not reach a caller, where it would be
+    // read, rewritten, or counted and named as inaccessible.
+    if (!isPathInsideDirectory(cwd, absolutePath))
+        return;
     if (maxDepth !== undefined) {
         const rel = relative(cwd, absolutePath);
         if (rel.split(/[/\\]/u).length - 1 > maxDepth)
@@ -305,13 +463,12 @@ function* processDirentMatch(match, cwd, maxDepth, seen, onlyFiles) {
     yield { path: absolutePath, dirent: match };
 }
 function createWalkFilter(cwd, skipIgnored, gitignoreMatcher, maxDepth, signal) {
-    if (!skipIgnored && maxDepth === undefined && signal === undefined)
-        return undefined;
     // fs.glob can hand the predicate a dirent whose parentPath is "." — the walk
     // root, not the process cwd — when it re-visits a directory under `**` whose
     // name also exists in the process cwd. Resolving against `cwd` names the
     // entry the dirent describes; `join` would resolve it against the process.
-    const relativeOf = (match) => toPosixPath(relative(cwd, resolve(cwd, match.parentPath, match.name)));
+    const absoluteOf = (match) => resolve(cwd, match.parentPath, match.name);
+    const relativeOf = (match) => toPosixPath(relative(cwd, absoluteOf(match)));
     // Every default exclude is a bare name that applies at any depth, so a Set
     // lookup per segment replaces compiling dozens of globs per entry.
     const excluded = (posixRel, isDir) => skipIgnored &&
@@ -323,6 +480,12 @@ function createWalkFilter(cwd, skipIgnored, gitignoreMatcher, maxDepth, signal)
             // pruning everything is the only way to stop a walk that yields nothing.
             if (signal?.aborted)
                 return true;
+            // fs.glob asks before it queues a directory, so a walk that would
+            // climb to `../` or start at `/` stops at the edge instead of reading
+            // there. Not every climb asks (`**/..` does not): processDirentMatch is
+            // the gate, this only saves the walk.
+            if (!isPathInsideDirectory(cwd, absoluteOf(match)))
+                return true;
             const posixRel = relativeOf(match);
             const isDir = match.isDirectory();
             if (excluded(posixRel, isDir))
@@ -343,7 +506,7 @@ async function* processGlobPattern(pattern, plan, seen, onlyFiles, filter, signa
     try {
         iterable = fsGlob(pattern, {
             cwd,
-            ...(filter ? { exclude: filter.prune } : {}),
+            exclude: filter.prune,
             withFileTypes: true,
         });
     }
@@ -359,7 +522,7 @@ async function* processGlobPattern(pattern, plan, seen, onlyFiles, filter, signa
             // A function `exclude` only prunes descent in fs.glob — it still yields
             // the rejected dirent itself, and any rejected entry below the top level.
             // Re-apply the ignore rules (not the depth bound) to drop those.
-            if (filter?.isExcluded(match))
+            if (filter.isExcluded(match))
                 continue;
             yield* processDirentMatch(match, cwd, maxDepth, seen, onlyFiles);
         }
@@ -375,7 +538,7 @@ async function* processGlobPattern(pattern, plan, seen, onlyFiles, filter, signa
 }
 export async function* globEntries(options) {
     const gitignoreMatcher = options.skipIgnored
-        ? await GitignoreManager.load(options.cwd, options.signal, options.maxDepth, options.ignoreCeiling)
+        ? await GitignoreManager.load(options.cwd, options.includeHidden ?? false, options.signal, options.maxDepth, options.ignoreCeiling)
         : null;
     const plan = normalizeGlobOptions(options);
     const seen = new Set();